Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have one child domain which references parent domain groups (it is a remote desktop gateway server into a restricted network segment).

This network is resitricted and only the child DC can communicate with the parent DC. Child member computers cannot perform queries to the parent domain controllers.

I believe I can set the root forest zone replication scope to 'All DNS servers in the forest that are domain controllers running Windows', and this would allow the child DC to resolve the parent domain queries, however this would push traffic everywhere.

Is there a way which I can push the root dns parent domain only for one particular child domain?

share|improve this question
up vote 2 down vote accepted

Replicating the forest root DNS zone isn't going to do anything other than let your clients in the child view DNS records for the parent.

What you want is to make the group in question a Universal Group. A Universal Security Group is replicated to all Global Catalogs in the forest, this means that a GC in your child can authoritatively answer the query without requiring a referral to the parent.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.